Harden the Revit assignment plan against missing objects and huge plans

- The command repository rejects user plans that link objects missing in
  the latest import, so the generic command route cannot bypass the rule.
- The plan schema limits the total number of objects to 10,000.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/external-object-assignment-plan-project-command.repository.test.ts

@@ -215,6 +215,35 @@ describe("external object assignment-plan project command", () => {
     }
   });
 
+  it("rejects user plans for objects missing in the latest import", () => {
+    const context = createFixture();
+    try {
+      context.db.update(externalModelObjects).set({ presenceStatus: "missing" })
+        .where(eq(externalModelObjects.id, "object-b1")).run();
+      const command = createExternalObjectAssignmentPlanProjectCommand(
+        externalObjectApplyAssignmentPlanCommandType,
+        {
+          ...planCommand(context.db).payload,
+          objects: planCommand(context.db).payload.objects.map(({ expected, target }) =>
+            expected.id === "object-b1"
+              ? { expected: { ...expected, presenceStatus: "missing" as const }, target: { ...target, presenceStatus: "missing" as const } }
+              : { expected, target }
+          ),
+        }
+      );
+      const before = readState(context.db);
+      assert.throws(
+        () => new ExternalObjectAssignmentPlanProjectCommandRepository(context.db).execute({
+          projectId: "project-1", expectedRevision: 0, source: "user", command,
+        }),
+        /Missing external objects cannot be assigned/
+      );
+      assert.deepEqual(readState(context.db), before);
+    } finally {
+      context.close();
+    }
+  });
+
   it("refuses undo after a created row was changed", () => {
     const context = createFixture();
     try {

tests/external-object-assignment-plan-route.test.ts

@@ -184,6 +184,14 @@ describe("Revit assignment plan route", () => {
       400
     );
     assert.equal((await call("POST", path, user, { ...plan(circuitListId), rows: [] })).status, 400);
+    const tooManyObjects = Array.from({ length: 10 }, (_, row) => ({
+      kind: "new-row",
+      circuitId: "c",
+      objectIds: Array.from({ length: 1001 }, (_, index) => `o-${row}-${index}`),
+    }));
+    const oversized = await call("POST", path, user, { ...plan(circuitListId), rows: tooManyObjects });
+    assert.equal(oversized.status, 400);
+    assert.match(await oversized.text(), /höchstens 10000 Revit-Objekte/);
   });
 
   it("rejects a circuit list of another project and unknown objects", async () => {